Is Enabling Double Escaping Dangerous?

c# asp.net-mvc iis-7
Alex picture Alex · Sep 21, 2009 · Viewed 76.2k times · Source

I have an ASP.NET MVC application with a route that allows searching for stuff via /search/<searchterm>.

When I supply "search/abc" it works well, but when I supply "/search/a+b+c" (correctly url encoded) then IIS7 rejects the request with HTTP Error 404.11 (The request filtering module is configured to deny a request that contains a double escape sequence). FIrst of all, why does it do this? It only seems to throw the error if it is part of the URL, but not as part of a query string ( /transmit?q=a+b+c works fine).

Now I could enable double escape requests in the security section of my web.config but I'm hesitant to do so as I don't understand the implications, and neither why the server would reject the request "a+b+c" as part of the URL but accept as part of a query string.

Can someone explain and give some advice what to do?

Answer

Eamon Nerbonne picture Eamon Nerbonne · Sep 21, 2009

Edit: Added emphasis to relevant sections.

Basically: IIS is being excessively paranoid. You can safely disable this check if you're not doing anything particularly unwise with the uri decoded data (such as generating local filesystem URI's via string concatenation).

To disable the check do the following (from here): (see my comment below for what double escaping entails).

<system.webServer>
    <security>
        <requestFiltering allowDoubleEscaping="true"/>
    </security>
</system.webServer>

If the plus symbol is a valid character in a search input, you will need to enable "allowDoubleEscaping" to permit IIS to process such input from the URI's path.

Finally, a very simple, if limited workaround is simply to avoid '+' and use '%20' instead. In any case, using the '+' symbol to encode a space is not valid url encoding, but specific to a limited set of protocols and probably widely supported for backwards-compatibility reasons. If only for canonicalization purposes, you're better off encoding spaces as '%20' anyhow; and this nicely sidesteps the IIS7 issue (which can still crop up for other sequences, such as %25ab.)

Related questions

Cache-control: no-store, must-revalidate not sent to client browser in IIS7 + ASP.NET MVC

I am trying to make sure that a certain page is never cached, and never shown when the user clicks the back button. This very highly rated answer (currently 1068 upvotes) says to use: Response.AppendHeader("Cache-Control", "no-cache, no-store, must-revalidate"); Response.…

Read More
Display custom error page when file upload exceeds allowed size in ASP.NET MVC

My main issue is that I want to display an custom error page when an uploaded file exceeds allowed size (maxRequestLength in web.config). When the big file is uploaded an HttpException is thrown before my upload action method in …

Read More
How to analyze the performance of requests in ASP.NET MVC application?

I would like to capture the hit time, processing time, memory consumption and response time of requests in ASP.NET MVC application. Is there any way or tool to perform this?

Read More